Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessAny class
- Any class
- Cross-site Scripting45
- Cross-Site Request Forgery16
- Open Redirect13
- Server-Side Request Forgery1
- Command and Code Injection7
- Injection and Smuggling4
- Denial of Service11
- Input Validation and Logic14
- Misconfiguration and Insecure Design13
- Cryptography14
- Information Disclosure30
- Authentication35
- Access Control18
- Insecure Direct Object Reference2
- Other weaknesses3
- No weakness recorded22
Access (title)Any
Access (analysis)Any
TechniqueAny
- Any
- Information disclosure2
- Missing authorisation check2
- 2FA bypass1
- Account takeover chain1
- Authentication bypass1
- Blind XSS1
- CRLF / header injection1
- Denial of service1
- IDOR / object reference1
- Leaked secret or key1
- Missing rate limit1
- OS command injection1
- Path traversal1
- postMessage flaw1
- Privilege escalation1
- Session fixation or reuse1
- Stored XSS1
248 of 15,219 reports · $84,989 in bounties · 161 analysed so far
- #591295ValidAnalysedPotential pre-auth RCE on Twitter VPNX / xAI · Command and Code Injection · 2019 · needs: no account · Path traversal, Information disclosure, 2FA bypass, Session fixation or reuse$20,1601,246votes
- #129873ValidAnalysedBypassing Digits origin validation which leads to account takeoverX / xAI · Authentication · 2020 · needs: a user account · Authentication bypass, postMessage flaw, Account takeover chain–619votes
- #446271ValidAnalysedCRLF injectionX / xAI · No weakness recorded · 2019 · needs: no account · CRLF / header injection–439votes
- #1032468ValidAnalysedRead-only application can publish/delete fleetsX / xAI · Access Control · 2021 · needs: a user account · Missing authorisation check, Privilege escalation–398votes
- #1207040ValidAnalysedBlind XSS on Twitter's internal Big Data panel at █████████████X / xAI · Cross-site Scripting · 2021 · needs: no account · Stored XSS, Blind XSS–357votes
- #885539ValidAnalysedPrivate list members disclosure via GraphQLX / xAI · Access Control · 2020 · needs: a user account · Missing authorisation check, IDOR / object reference, Information disclosure, Missing rate limit–346votes
- #210779ValidAnalysed[Urgent] Invalidating OAuth2 Bearer token makes TweetDeck unavailableX / xAI · Denial of Service · 2019 · needs: no account · Denial of service, Leaked secret or key–323votes
- #770504ValidBypass Password Authentication for updating email and phone number - Security VulnerabilityX / xAI · Authentication · 2020–288votes
- #110293ValidInsufficient OAuth callback validation which leads to Periscope account takeoverX / xAI · Authentication · 2019–277votes
- #168116ValidInsufficient validation on Digits bridgeX / xAI · Authentication · 2020–263votes
- #248668ValidXXE on sms-be-vip.twitter.com in SXMP ProcessorX / xAI · Injection and Smuggling · 2017–258votes
- #683298ValidXSS and Open Redirect on MoPub LoginX / xAI · Open Redirect · 2019$1,540248votes
- #341908ValidXSS via Direct Message deeplinksX / xAI · Cross-site Scripting · 2019–236votes
- #485748ValidStored XSS on reports.X / xAI · Cross-site Scripting · 2019$700232votes
- #583987ValidPeriscope android app deeplink leads to CSRF in follow actionX / xAI · Cross-Site Request Forgery · 2020$1,540224votes
- #1031321ValidGithub Account hijack through broken link in developer.twitter.comX / xAI · Input Validation and Logic · 2021–222votes
- #1439026ValidDiscoverability by phone number/email restriction bypassX / xAI · Access Control · 2022$5,040217votes
- #317476ValidAccount Takeover in Periscope TVX / xAI · Cross-site Scripting · 2018–213votes
- #84601ValidXSS and cache poisoning via upload.twitter.com on ton.twitter.comX / xAI · Cross-site Scripting · 2019–198votes
- #574962ValidVerify any unused email addressX / xAI · Access Control · 2019$560197votes
- #664038Validprotected Tweet settings overwritten by other settingsX / xAI · No weakness recorded · 2020–178votes
- #321699ValidTakeover of Twitter-owned domain at mobileapplinking.comX / xAI · Input Validation and Logic · 2019–159votes
- #505424ValidTwitter ID exposure via error-based side-channel attackX / xAI · Information Disclosure · 2019$1,470154votes
- #591432ValidTwitter Periscope Clickjacking VulnerabilityX / xAI · Misconfiguration and Insecure Design · 2019$1,120144votes
- #500686Validurl that twitter mobile site can not loadX / xAI · Denial of Service · 2019$1,120142votes
- #819088Validcharacter limitation bypass can lead to DoS on Twitter App and 500 Internal Server ErrorX / xAI · Denial of Service · 2020–141votes
- #544329ValidIDOR and statistics leakage in OrdersX / xAI · Insecure Direct Object Reference · 2019$289141votes
- #770349ValidReflected XSS in twitterflightschool.comX / xAI · Cross-site Scripting · 2020–140votes
- #85624ValidHighly wormable clickjacking in player cardX / xAI · Misconfiguration and Insecure Design · 2018–134votes
- #126522ValidIncorrect param parsing in Digits web authenticationX / xAI · Authentication · 2018–126votes
- #867616ValidXSS via referrer parameterX / xAI · Cross-site Scripting · 2020–124votes
- #202823ValidVine all registered user Private/sensitive information disclosure .[ Ip address/phone no/email and many other informations ]X / xAI · Information Disclosure · 2017–121votes
- #472013ValidChanging email address on Twitter for Android unsets "Protect your Tweets"X / xAI · Information Disclosure · 2019$2,940119votes
- #208978Valid[URGENT] Opportunity to publish tweets on any twitters accountX / xAI · No weakness recorded · 2017–119votes
- #2244229ValidCross-Domain Leakage of X Username / UserID due to Dynamically Generated JS FileX / xAI · Information Disclosure · 2024$1,500115votes
- #114169ValidBypassing Digits web authentication's host validation with HPPX / xAI · Authentication · 2016–108votes
- #470749ValidAbility to perform actions (Tweet, Retweet, DM) and other actions, unauthenticated, on any account with SMS enabled.X / xAI · Input Validation and Logic · 2019 · no account (title)–106votes
- #191884ValidRemote Unrestricted file Creation/Deletion and Possible RCE.X / xAI · Command and Code Injection · 2017–100votes
- #1369674ValidBlind XSS on Twitter's internal Jira panel at ████ allows exfiltration of hackers reports and other sensitive dataX / xAI · Cross-site Scripting · 2022–99votes
- #945990ValidSafe Redirect BypassX / xAI · Other weaknesses · 2020$56098votes
- #712979ValidCreating malformed URLs via new line character in-between two URLs leads to misrepresented hyperlinks in Tweets/DMsX / xAI · Injection and Smuggling · 2020–96votes
- #499348ValidTwitter lite(Android): Vulnerable to local file steal, Javascript injection, Open redirectX / xAI · Access Control · 2019–95votes
- #201300ValidAttacker can get vine repost user all informations even Ip address and location .X / xAI · Authentication · 2017–95votes
- #612231ValidGithub Token Leaked publicly for https://github.com/mopubX / xAI · Cryptography · 2019–92votes
- #110467ValidBypassing Digits bridge origin validationX / xAI · Authentication · 2017–92votes
- #1694304ValidAble to see Twitter Circle tweets due to improper access control on the "FavoriteTweet" endpointX / xAI · Access Control · 2024–91votes
- #903740ValidDenial of Service | twitter.com & mobile.twitter.comX / xAI · Denial of Service · 2020$1,12089votes
- #235642Valid[CRITICAL] Full account takeover using CSRFX / xAI · Cross-Site Request Forgery · 2017–88votes
- #1841064DuplicateAbility to getting Twitter Blue verified badge without purchase itX / xAI · Input Validation and Logic · 2024–85votes
- #297968ValidPersistent DOM-based XSS in https://help.twitter.com via localStorageX / xAI · Cross-site Scripting · 2018–84votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.